• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Universal ReadBack Extractor for mtk feature watchphones

Search This thread

Golem_

Senior Member
Oct 23, 2015
2,233
825
Update Mar-12/2016: as long as on the market appeared a long line of new types of mtk6260 mtk6261 mtk2502C mtk2502A (etc) watches equipped with strange new PCB or flash_ID parameters, the new release <Readback Extractor mtk 2.0> now has the capacity to identify, to read, check, rebuild firmware and collect and insert in the .cfg files the flash_ID's coded inside the ROM dump for almost all types of mtk watchphones or smartwatches based on RTOS Nucleus

NOTE: being tested already for mtk6260 mtk6261 mtk2502C and mtk2502A

In short - if you intend to install in your smartwatch new firmwares, mods etc, before to initiate any flashing with the Flash Tool app (pushing that goddamn < Download > button) think twice, 'bove all better DO a backup for the original firmware, why so? because it's containing all original drivers hence you'll be able to recover 100% your watch in case of bricking.

How to:
First you have need of a full dump of your ROM. Assuming that you already got a Flash Tool 5.15.16 and drivers, and you were at the point of flashing something (already chose the download agent and scatter file)

preparations:
a. Set options/backup and restore on no action
b. load the download agent (you find this file inside the flash tool folder)
c. load a scatter firmware - for initialization flash tool needs a scatter file (.cfg) - for dz09 you get this one - for any other than mtk6260A get here and get a firmware compatible with your PCB
d. in case you have W10 - go to the start menu and click on power and hold down the shift key while clicking on restart. A screen then comes up and you need to choose troubleshooting and then startup options. It will then reboot and give you a menu. press 7 which is ignore signed drivers and then when windows comes up, you will be able to install the drivers.

for instance let's say you have a DZ09 smartwatch:
1 - press < Readback > in upper menu and so < Add > in the middle menu
2 - click twice on the item appears in the main window, set name as ROM_DZ choose in browser the path and save
3 - set as Physical start address 0x00000000 and as Length 0x01000000 or 0x00800000 or 00400000 (try them in this order) then ok
4 - turn off the watch, press < Readback > in the middle menu wait 2 seconds and connect through USB your watch
5 - wait until the upload is complete (big green ring)

Now second stage:
1 - download the app I've built attached here (Readback Extractor mtk) and unzip it
2 - create a folder where you intend to keep in safe the original firmware and name it for instance DZ09-Orig
3 - do a copy of Readback Extractor mtk 2.0.exe and place it inside the DZ09-Orig folder then click twice on it
4 - press <Load Readback file> and browse after the ROM_DZ file created before with the Flash Tool then open
5 - Wait about a minute while the app will check bit by bit the integrity of your file
6 - If everything went ok and your file is healthy then app will show " health 100% " so you can proceed to the next step
7 - Press <Rebuild Firmware> and wait about one minute (it shows a progress counter)
8 - When appears the message " - ALL DONE!!!" close app and go back in the DZ09-Orig folder, now you'll find there a set of new files which are the original firmware kit ready to be flashed back in your phone anytime you want
9 - Enjoy flashing anything you like without any fear that something bad can happen

Some tricks for writing IMEI in your watch NVRAM:
you connect to usb your watch (turned on this time) and set the com port on the watch screen, go in device manager and check the port number your watch is connected, then you open Tera Term hyperterminal (google for this app), connect it as serial com on watch com port and then give the command:
AT + EGMR = 1, 7, " imei number "
if on screen appears OK then ready, you've changed your imei


AFTERWARDS READ ME story - Anywhere you search, there is no one to tell you explicitly how to extract from your mtk smartwatch the firmware kit
All says a halfmouth: Do a full < Readback > in Flash Tool, you'll do it being confident that from now on you say goodbye to any risk because you have A BACKUP hence you start flashing new firmwares. And the Big Brick is coming , you smile and get back to your < Readback > backup discovering that, sadly, you have a binary bulk at first sight good for nothing. It cannot be so useless, isn't it? after all it contains full dump of your ROM! I was in exactly the same situation, so 'cause I didn't find any answer I've started reverse engineering . . . and it worked, first I did it manually for guys being in the same situation, 've noticed that is a common issue so I had to choose how to help, simpler but dangerous (for you) way, to create a tutorial <how to> or the hard way (hard for me), to develop an app which will do all "cooking" automatically and I choose the second because in manually way there is a quite big "chance" to mess up with your primary bootloader which could get to a real tragedy - no modem - brickest brick you saw in your entire life


Readback extractor mtk 2.1 beta
Flash Tool and drivers
 

Attachments

  • Readback Extractor mtk 2.4.rar
    121.4 KB · Views: 361
Last edited:

Golem_

Senior Member
Oct 23, 2015
2,233
825
Lil to late for me XD.... *just ordered a new one btw*

Sorry man, couldn't earlier because I have mine either of two weeks or so. . . still a beginner
Look at the bright side, best lessons we learn from our own mistakes, best part is that if you buy the new one from the same seller, you'll have the firmware hence two working watches!
 
  • Like
Reactions: Andrew-X

Golem_

Senior Member
Oct 23, 2015
2,233
825
Are there apps in the works to change watch faces without flashing?

Unfortunately, yet, there is no way to get in contact with the watch else than through proprietary mediatek drivers so that the only ways to communicate for now are Flash Tool app and bluetooth modem proprietary commands (the most important of them being secret as well)
To do such a reverse engineering is way way way over my pay grade
Still I'm working for an app which could replace any media in the watch (backgrounds, icons) but through flashing method of course
 
Last edited:

kyitech

New member
Jan 9, 2016
3
0
Unfortunately, yet, there is no way to get in contact with the watch else than through proprietary mediatek drivers so that the only ways to communicate for now are Flash Tool app and bluetooth modem proprietary commands (the most important of them being secret as well)
To do such a reverse engineering is way way way over my pay grade
Still I'm working for an app which could replace any media in the watch (backgrounds, icons) but through flashing method of course

Sorry for not knowing, but what about bluetooth app transfer in the Google play store. How can they be used on dz09-?
 

Golem_

Senior Member
Oct 23, 2015
2,233
825
Sorry for not knowing, but what about bluetooth app transfer in the Google play store. How can they be used on dz09-?

. . . bluetooth modem AT commands, just I told this before, generally speaking, in this way all bluetooth app are working, in our case they are proprietary and most of them SECRET. For more information please check this link, it is an older tutorial posted by me on that site
 
Last edited:
  • Like
Reactions: Andrew-X

Golem_

Senior Member
Oct 23, 2015
2,233
825
Lil to late for me XD.... *just ordered a new one btw*

I'm almost sure you found these before me, still, here link you have more than 10 versions of dz09 firmwares (others than we checked before)

It looks like they made a firmware for each phone :)) very prolific guys when about dz09
Hope this time you catch the right one!
 
  • Like
Reactions: Andrew-X

franc33s

Member
Nov 3, 2012
49
6
Willemstad
I'm almost sure you found these before me, still, here link you have more than 10 versions of dz09 firmwares (others than we checked before)

It looks like they made a firmware for each phone :)) very prolific guys when about dz09
Hope this time you catch the right one!

yup already did try them all, they boot fine, just no luck getting the Padgene (padgeME) one yet (so my touchscreen driver would work), the guy is still uploading more firmwares tough *fingers crossed*
 

carlospaco

Senior Member
Oct 24, 2009
329
37
flashtool

Hy ,
I am trying to search for the wright flashtool to make my backup.
And where can i find a tutorial?
I have a gv08s.
Wich drivers do i need, and wich version of flashtool?
Thanks in advance
 

xeph20

Senior Member
Mar 6, 2012
190
26
thank you for kind words!

sR98APA.jpg
 

carlospaco

Senior Member
Oct 24, 2009
329
37
here link you find a good tutorial but instead <download> you have to use <readback>
Yes , i have done everything like its said, for couple off days, but i keep getting this error always.
lashtool error: S_BROM_DOWNLOAD_EPP_FAIL (2036)
[EPP] FlashTool environment preparation failed
It May be caused from DRAM initialization failed

Pleace check the EMI information of the MAUI load is correct and fit the target.

Hope that someone can help me with this, i am desperated.
Thanks
 

Golem_

Senior Member
Oct 23, 2015
2,233
825
Yes , i have done everything like its said, for couple off days, but i keep getting this error always.
lashtool error: S_BROM_DOWNLOAD_EPP_FAIL (2036)
[EPP] FlashTool environment preparation failed
It May be caused from DRAM initialization failed

Pleace check the EMI information of the MAUI load is correct and fit the target.

Hope that someone can help me with this, i am desperated.
Thanks

give me in PM a skype ID
 

Top Liked Posts

  • There are no posts matching your filters.
  • 60
    Update Mar-12/2016: as long as on the market appeared a long line of new types of mtk6260 mtk6261 mtk2502C mtk2502A (etc) watches equipped with strange new PCB or flash_ID parameters, the new release <Readback Extractor mtk 2.0> now has the capacity to identify, to read, check, rebuild firmware and collect and insert in the .cfg files the flash_ID's coded inside the ROM dump for almost all types of mtk watchphones or smartwatches based on RTOS Nucleus

    NOTE: being tested already for mtk6260 mtk6261 mtk2502C and mtk2502A

    In short - if you intend to install in your smartwatch new firmwares, mods etc, before to initiate any flashing with the Flash Tool app (pushing that goddamn < Download > button) think twice, 'bove all better DO a backup for the original firmware, why so? because it's containing all original drivers hence you'll be able to recover 100% your watch in case of bricking.

    How to:
    First you have need of a full dump of your ROM. Assuming that you already got a Flash Tool 5.15.16 and drivers, and you were at the point of flashing something (already chose the download agent and scatter file)

    preparations:
    a. Set options/backup and restore on no action
    b. load the download agent (you find this file inside the flash tool folder)
    c. load a scatter firmware - for initialization flash tool needs a scatter file (.cfg) - for dz09 you get this one - for any other than mtk6260A get here and get a firmware compatible with your PCB
    d. in case you have W10 - go to the start menu and click on power and hold down the shift key while clicking on restart. A screen then comes up and you need to choose troubleshooting and then startup options. It will then reboot and give you a menu. press 7 which is ignore signed drivers and then when windows comes up, you will be able to install the drivers.

    for instance let's say you have a DZ09 smartwatch:
    1 - press < Readback > in upper menu and so < Add > in the middle menu
    2 - click twice on the item appears in the main window, set name as ROM_DZ choose in browser the path and save
    3 - set as Physical start address 0x00000000 and as Length 0x01000000 or 0x00800000 or 00400000 (try them in this order) then ok
    4 - turn off the watch, press < Readback > in the middle menu wait 2 seconds and connect through USB your watch
    5 - wait until the upload is complete (big green ring)

    Now second stage:
    1 - download the app I've built attached here (Readback Extractor mtk) and unzip it
    2 - create a folder where you intend to keep in safe the original firmware and name it for instance DZ09-Orig
    3 - do a copy of Readback Extractor mtk 2.0.exe and place it inside the DZ09-Orig folder then click twice on it
    4 - press <Load Readback file> and browse after the ROM_DZ file created before with the Flash Tool then open
    5 - Wait about a minute while the app will check bit by bit the integrity of your file
    6 - If everything went ok and your file is healthy then app will show " health 100% " so you can proceed to the next step
    7 - Press <Rebuild Firmware> and wait about one minute (it shows a progress counter)
    8 - When appears the message " - ALL DONE!!!" close app and go back in the DZ09-Orig folder, now you'll find there a set of new files which are the original firmware kit ready to be flashed back in your phone anytime you want
    9 - Enjoy flashing anything you like without any fear that something bad can happen

    Some tricks for writing IMEI in your watch NVRAM:
    you connect to usb your watch (turned on this time) and set the com port on the watch screen, go in device manager and check the port number your watch is connected, then you open Tera Term hyperterminal (google for this app), connect it as serial com on watch com port and then give the command:
    AT + EGMR = 1, 7, " imei number "
    if on screen appears OK then ready, you've changed your imei


    AFTERWARDS READ ME story - Anywhere you search, there is no one to tell you explicitly how to extract from your mtk smartwatch the firmware kit
    All says a halfmouth: Do a full < Readback > in Flash Tool, you'll do it being confident that from now on you say goodbye to any risk because you have A BACKUP hence you start flashing new firmwares. And the Big Brick is coming , you smile and get back to your < Readback > backup discovering that, sadly, you have a binary bulk at first sight good for nothing. It cannot be so useless, isn't it? after all it contains full dump of your ROM! I was in exactly the same situation, so 'cause I didn't find any answer I've started reverse engineering . . . and it worked, first I did it manually for guys being in the same situation, 've noticed that is a common issue so I had to choose how to help, simpler but dangerous (for you) way, to create a tutorial <how to> or the hard way (hard for me), to develop an app which will do all "cooking" automatically and I choose the second because in manually way there is a quite big "chance" to mess up with your primary bootloader which could get to a real tragedy - no modem - brickest brick you saw in your entire life


    Readback extractor mtk 2.1 beta
    Flash Tool and drivers
    3
    Hello, I followed the procedure but in my firmware I can not find the ROM file.
    While it is present in the firmware XDA DZ09 ...
    In the reading of the Watch did not appear the ROM file.
    As revenue?
    thank you.

    ---------- Post added at 10:41 AM ---------- Previous post was at 10:07 AM ----------



    For clarity, I redid Read Back and saved the ROM file in the folder of my original firmware.
    I open MTK Res 1.3, I open my ROM file and edit the faces, then save and overwrite the same file ROM.
    I open Flashtool, Scatter / config file, I select the file * .cfg of my original firmware folder (where the ROM file is present).
    Flash clock, okay.
    They turn on the clock, but come out the same faces (do not I see those I changed). :crying:
    Where am I wrong? :confused:

    So you are calling original firmware the firmware from where you get the scatter? No, that is just other firmware you're using in order to initialize the flash tool. As in description, you create a folder (empty one!!!) where you have to save the readback dump. then look UNDER description, there is attached an app, readback extractor, download the app and move it in the same folder with the readback dump, then follow the next steps - in this way will be generated A NEW FIRMWARE - if readback extractor doesn't show at the end of the process that "all done" then stop everything, is something wrong with your readback dump and you have to redo the readback with other parameters - we are calling it the original one because is extracted from your watch! this kit has its own cfg and a rom file (which can have different names - in our case FILE_01_mtk). Do a copy of this folder, go in mtk res choose the rom file (FILE_01_mtk) and modify watchfaces, then go in flash tool, choose the cfg file from the folder copy where you did modification, check in options/backup and restore - preserve backup data and backup-download/format-restore, then press download button (which is flashing) - connect your watch, wait till the flashing is ready
    3
    Are there apps in the works to change watch faces without flashing?

    Unfortunately, yet, there is no way to get in contact with the watch else than through proprietary mediatek drivers so that the only ways to communicate for now are Flash Tool app and bluetooth modem proprietary commands (the most important of them being secret as well)
    To do such a reverse engineering is way way way over my pay grade
    Still I'm working for an app which could replace any media in the watch (backgrounds, icons) but through flashing method of course
    3
    Yes , no problem.
    I took me also great time, i did it with google translate.
    But i will put in google drive.
    And i am also looking for MTK RESOURSE EDITOR.
    I find one but my virus scanner saying that there is a virus on it.
    Here is the rom gv08s full master
    https://drive.google.com/open?id=0B2z3YUYL-iowR3FXVmVPYm9YNWM

    Thanks for the link and here attached you have the MTK RESOURSE EDITOR, no virus version :)
    Unfortunately is pretty poor, It sees just official compressors (jpg, gif . . . this kind of things) but cannot see mtk compressors - I found that lately (few fellows around came with their firmwares) mediatek is trying to eliminate any common formats so I found inside these JUST mtk media format which right now I have it in process of reverse engineering
    3
    Many thanks @Golem_ :)

    I try with Zeblaze Crystal mtk2502A with length of 0x01000000 and it works.

    But when I use the readback extractor mtk 2.0 and load readback file, give me the follow message:

    error_1.jpg


    What am I doing wrong? :confused:

    Regards,
    Jorge

    Yea, lately I didn't do any updates for readback extractor - no worries about, just new different (newcomers) standards my app didn't know about - good you "woke me up" - too busy and forgot about the latest release I was working on, compiled it right now and "voila" - check on the first page the 2.4 release and let me know if it's working for you

    Use your money wisely, DO NOT WASTE IT buying from GEARBEST